CVE-2023-52895

CVE-2023-52895 concerns a race in the Linux kernel io_uring/poll for multishot requests. A prior commit fixed a poll race that applies only to multishot, where a spurious wakeup can be ignored since the waitqueue isn’t left. A blunt reissue of a multishot armed request could leak a buffer if prov...

CVE-2017-8067

The vulnerability CVE-2017-8067 affects the Linux kernel drivers/char/virtio_console.c in kernels 4.9.x and 4.10.x prior to 4.10.12, where improper interaction with CONFIG_VMAP_STACK allows a local user to cause a denial of service (system crash or memory corruption) or other impact by using more...

CVE-2021-47092

Summary: CVE-2021-47092 relates to a Linux kernel KVM VMX issue where setting vmx->fail during emulation_required in L2 nesting was incorrect, potentially causing a VM-Exit/VM-Fail contradiction and a warning during teardown (nested_vmx_vmexit). The fix reverts that change so vmx->fail is n...

CVE-2021-47130

The CVE refers to a Linux kernel fix in nvmet: when a p2p device is found but the p2p pool is empty, the nvme target incorrectly freed the sgl from the p2p pool, leading to a BUG() crash. The fix ensures the nvme request only uses the p2p_dev if it was allocated from the p2p pool, avoiding freein...

CVE-2021-47244

The CVE-2021-47244 entry concerns the Linux kernel mptcp option parsing (mptcp_get_options). The vulnerability is a potential out-of-bounds read when parsing TCP options: if an option’s length is 1, the parser loops and reads the opcode byte; if the opcode is not TCPOPT_EOL or TCPOPT_NOP, it read...

CVE-2021-47470

CVE-2021-47470 affects the Linux kernel. The issue is in the mm/slab subsystem (slab_debugfs_fops) where a use-after-free can occur if sysfs_slab_add fails, because the slab object “s” is freed soon after and then used later by slab_debugfs_fops. The connected Astra Linux advisory confirms this d...

CVE-2021-47561

CVE-2021-47561 affects the Linux kernel i2c virtio driver. The issue arises when a timeout occurs: the device can continue operating on buffers the guest has freed, risking data corruption on the I2C bus and potential memory corruption inside the guest. The root cause is improper timeout handling...

CVE-2022-1976

CVE-2022-1976 affects the Linux kernel IO-URING implementation. The flaw allows a local attacker to craft a sequence of requests that triggers a use-after-free in the kernel, leading to memory corruption and possible privilege escalation. Across multiple sources, the issue is described without pu...

CVE-2022-48778

CVE-2022-48778 concerns a Linux kernel issue in mtd: rawnand gpmi where a PM runtime reference could leak in the error path if gpmi_nfc_apply_timings() fails. The provided documents consistently describe the vulnerability and its resolution, noting that the PM runtime usage counter must be droppe...

CVE-2022-48800

CVE-2022-48800 : In the Linux kernel, a soft lockup deadlock was observed involving kcompactd when rescheduling and draining PCP lists during page migration, caused by throttling not making progress. The issue is tied to CONFIG_PREEMPT being disabled (CONFIG_PREEMPT=n) and a task migrating pages ...

CVE-2022-48890

No connected documents with concrete technical details for CVE-2022-48890 beyond the initial description. Technical specifics (affected components/versions/exploit specifics) are not provided here; monitor for updates.

CVE-2022-48952

CVE-2022-48952 affects the Linux kernel PCI mt7621 path. The issue was a missing sentinel in the soc_device_attribute array, causing an oops during soc_device_match(mt7621_pcie_quirks_match). The fix adds the required sentinel in the attribute table (commit 7c18b64bba3b) and updates mt7621 exposu...

CVE-2022-48963

CVE-2022-48963 refers to a Linux kernel flaw in net: wwan: iosm where a memory leak could occur if allocation of ipc_mux->ul_adb.pp_qlt in ipc_mux_init() fails, leaving ipc_mux unreleased. The CVE is documented as resolved in multiple vendor advisories; the NVD entry cites a CVSSv3.1 base scor...

CVE-2022-48986

CVE-2022-48986 is a Linux kernel issue in the memory management path (mm/gup) affecting devmap-backed dax mappings. The vulnerability arises from gup_pud_range() returning true for pud_huge() on x86 when hugetlb is configured, while dax does not depend on hugetlb. The fixes, including commits 414...

CVE-2022-49360

CVE-2022-49360 (Linux kernel, f2fs): The issue arises from a root-cause mismatch where ckpt.valid_block_count is inconsistent with the SIT table, causing a panic during garbage collection when the LFS allocator cannot find a free segment despite the filesystem reporting free blocks. The reference...

CVE-2022-49554

CVE-2022-49554 concerns the Linux kernel’s zsmalloc code. The issue arises from races between the asynchronous zspage free worker and page migration, where lock_zspage() may interact with pages that migrate away, leading to potential invalid dereferences and incomplete locking of zspage page list...

CVE-2022-49582

This CVE-ID (CVE-2022-49582) is associated with the Linux kernel: net: dsa: fix NULL pointer dereference in dsa_port_reset_vlan_filtering. The root cause described in the sources is that the ds iterator variable used in dsa_port_reset_vlan_filtering() -> dsa_switch_for_each_port() overwrites t...

CVE-2022-49692

The CVE-2022-49692 issue is a Linux kernel fix for the at803x PHY NULL pointer dereference on AR9331 PHY. The vulnerability manifested as kernel paging fault during PHY interrupt handling, traced to AR9331 switch/MDIO initialization and phylink/dsa probe paths. The remedy is in the latest kernel ...

CVE-2022-49744

The CVE-2022-49744 entry concerns a Linux kernel mm/uffd issue: when forking, the dst_vma may not inherit VM_UFFD_WP even if the src has it, leading to a stale pte marker and potential access to a corrupted page. The fix is a two‑patch series under “mm: Fixes on pte markers” that hardens pte mark...

CVE-2022-49747

Summary (concrete details found in connected docs): CVE-2022-49747 refers to a Linux kernel issue where the offset calculation in erofs/zmap.c was incorrect, causing iomap->length to be set to 0 and triggering a WARN_ON in iomap_iter_done(). The issue affects the kernel’s handling path involvi...

CVE-2022-49831

The CVE relates to the Linux kernel btrfs zoned feature. The issue occurs during seeding on a zoned filesystem if each zoned device’s btrfs_zoned_device_info is not initialized, causing a NULL pointer dereference when mounting. Multiple sources confirm this vulnerability and its resolution in the...

CVE-2022-49950

CVE-2022-49950 affects the Linux kernel: a bug in misc: fastrpc where the probe session-duplication overflow increments the session count even when no sessions are available, allowing memory corruption beyond the fixed-size slab-allocated fastrpc_session array during open(). This was fixed in the...

CVE-2022-49963

In CVE-2022-49963, the Linux kernel vulnerability centers on the drm/i915/ttm CCS handling fix. The issue arises in migrate_copy(), where object copying and address translation fail for large objects: using plain integers can overflow, and emitting PTEs with the entire object size when src is lme...

CVE-2022-50047

The CVE-2022-50047 issue affects the Linux kernel’s net: dsa mv88e6060 code. When a port is neither a CPU port nor a user port, cpu_dp can be NULL, causing a NULL pointer dereference and kernel crash during mv88e6060_setup_port(). This is a local impact vulnerability that leads to a crash; connec...

CVE-2022-50094

CVE-2022-50094 relates to Linux kernel spmi trace: trace_spmi_write_begin() and trace_spmi_read_end() use memcpy() with length len + 1, causing a potential stack-out-of-bounds read. A KASAN report demonstrates an out-of-bounds read in trace_event_raw_event_spmi_read_end. The issue affects the SPM...

CVE-2022-50108

CVE-2022-50108 affects the Linux kernel via the mfd: max77620 sub-system. The root cause is a refcount leak in max77620_initialise_fps: of_get_child_by_name() returns a node pointer with an incremented refcount, and the patch adds missing of_node_put() to release it when no longer needed. The iss...

CVE-2022-50207

Summary (CVE-2022-50207) : In the Linux kernel, ARM bcm Kona handling had a refcount leak in bcm_kona_smc_init. The root cause: of_find_matching_node() returns a node pointer with an incremented refcount and may not be released. The patch adds a missing of_node_put() to drop the reference when th...

CVE-2023-20811

CVE-2023-20811 involves a boundary-check failure in the MediaTek IOMMU, causing an out-of-bounds write that could enable local privilege escalation with system privileges. Affected component: IOMMU sub-system (MediaTek). Root cause: missing bounds check leading to out-of-bounds write. Impact: loc...

CVE-2023-32246

CVE-2023-32246 refers to a race in ksmbd where rcu_barrier() is not invoked during module unload, potentially allowing unloading with pending RCU callbacks and unintended kernel code execution. Multiple sources indicate the vulnerability has been resolved in the Linux kernel; no exploitation deta...

CVE-2023-39176

CVE-2023-39176 concerns the ksmbd kernel module in Linux, where parsing of SMB2 transform-header requests allows reading past the end of an allocated buffer. This results in information disclosure on affected systems with ksmbd enabled. Public sources in the connected documents consistently descr...

CVE-2023-53061

CVE-2023-53061 affects the Linux kernel (ksmbd) and describes a refcount leak in smb2_open() where the reference count of acls can leak if memory allocation fails. The fix adds the missing posix_acl_release() to prevent the leak. Connected documents confirm the vulnerability was addressed in the ...

CVE-2024-42254

CVE-2024-42254 affects the Linux kernel io_uring subsystem. The issue stems from inconsistent NULL vs IS_ERR error handling in io_alloc_pbuf_ring(), leading to a KASAN null pointer dereference in __io_remove_buffers and related cleanup paths (/io_uring/kbuf.c and io_uring.c). The vulnerability wa...

CVE-2024-43862

CVE-2024-43862 affects the Linux kernel’s net: wan: fsl_qmc_hdlc component. The root cause is using a spinlock (carrier_lock) to protect carrier detection while framer_get_status() may take a mutex, creating a potential deadlock. The issue is addressed by converting carrier_lock from a spinlock t...

CVE-2024-53186

CVE-2024-53186 : Linux kernel ksmbd race condition causing use-after-free in SMB request handling. The issue is between ksmbd_conn_handler_loop() waiting for conn->r_count to reach zero and handle_ksmbd_work() decrementing and freeing the ksmbd_conn, after which the code may still touch conn-&...

CVE-2024-54191

CVE-2024-54191 affects the Linux kernel Bluetooth stack (ISO). The issue arises from a circular lock between the socket lock and hdev lock in the ISO path. The fix reworks iso_sock_recvmsg and related code so that the socket lock is released before acquiring hdev, breaking the circular dependency...

CVE-2024-57988

In the Linux kernel, the Bluetooth driver btbcm had a NULL pointer dereference in btbcm_get_board_name() when devm_kstrdup() could return NULL. The fix adds a NULL check in btbcm_get_board_name() to prevent the dereference.

CVE-2025-21788

Summary (CVE-2025-21788) : In the Linux kernel’s net/ethernet/ti/am65-cpsw driver, memory allocated for SKB via am65_cpsw_build_skb() may leak when an XDP program does not return XDP_PASS. The root cause is allocating SKB memory before evaluating the XDP program result, which wastes CPU cycles fo...

CVE-2025-21805

Technical details for CVE-2025-21805 are not disclosed in the provided documents; no affected products, exploit information, or fixes are specified here. Monitor for updates from the referenced sources.

CVE-2025-21842

The CVE-2025-21842 entry concerns amdkfd in the Linux kernel where gang_ctx_bo memory is not freed correctly when user-queue init fails. The destructor for a gtt BO is declared as void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device adev, void mem_obj), taking a void . GCC will implicitly allow p...

CVE-2025-21843

CVE-2025-21843 concerns the Linux kernel DRM panthor component (panthor_ioctl_dev_query). The issue is that priorities_info is uninitialized and its value can be copied to a user object when PANTHOR_UOBJ_SET() is invoked. The documented fix is to initialize priorities_info (e.g., via memset) to a...

CVE-2025-21940

Technical details about CVE-2025-21940 are not publicly provided in the supplied documents. No affected products, versions, or fixes are explicitly described here. Monitor for vendor advisories and patch releases.

CVE-2025-21954

CVE-2025-21954: Linux kernel netmem component vulnerability where TX of unreadable SKBs could be forwarded, potentially triggering unsafe DMA mappings. The issue arises because stable trees supported netmem RX but not TX, making unreadable RX netmem packets unsafe to forward into the device TX pa...

CVE-2025-37975

CVE-2025-37975 : Linux kernel riscv module relocation fix for out‑of‑bounds access in relocation handling. The patch replaces the end‑of‑relocation access rel[j] with a bounds‑checked approach using num_relocations, effectively correcting the relocation size calculation. The vulnerability is desc...

CVE-2025-38056

The CVE-2025-38056 vulnerability affects the Linux kernel ASoC: SOF Intel HDA path. Specifically, hda_generic_machine_select() appends -idisp to the tplg filename by allocating a new string and storing it into a global, which becomes a freed pointer after module unloads, enabling a use-after-free...

CVE-2025-38207

CVE-2025-38207 : In the Linux kernel, a bug in the uprobe handling during vma expansion could cause the upnode page table entry (pte) to be overwritten, potentially orphaning the upbump page. The issue arises when remapping a vma that includes an uprobe, causing a pte overwrite during the set_pte...

CVE-2025-38333

CVE-2025-38333 affects the Linux kernel (f2fs) and is tied to get_new_segment() logic. The issue occurs when get_new_segment() detects inconsistent status between free_segmap and free_secmap, records the error in the superblock, and bails out instead of continuing to use the segment. The provided...

CVE-2025-38438

CVE-2025-38438 – Linux kernel ASoC: SOF: Intel: hda: devm_kstrdup() used to prevent memleak. The issue arises in sof_pdata->tplg_filename where memory allocated by kstrdup() could be overwritten, creating a memory leak detected by kmemleak. The vulnerability is specific to the SOF Intel HDA dr...

CVE-2025-38546

CVE-2025-38546 (Linux kernel: ATM clip memory leak) The vulnerability is in the ATM subsystem’s clip code. The ioctl ATMARPD_CTRL path assigns NULL to vcc->push(), which breaks the expected cleanup path and leaks memory for the allocated struct clip_vcc during ATMARP handling. The root cause i...

CVE-2025-38550

CVE-2025-38550 is a Linux kernel issue in ipv6 multicast handling. The root cause is delaying the release of the reference to pmc->idev in mld_del_delrec(), while pmc->idev is also used by ip6_mc_clear_src(). The fix (as stated) is to put the reference after ip6_mc_clear_src() returns. The ...

CVE-2025-38561

CVE-2025-38561 concerns the ksmbd component of the Linux kernel. A race condition on Preauh_HashValue may occur when a client sends multiple session setup requests to ksmbd, due to how sess->Preauh_HashValue was previously freed during session setup. The fix moves freeing of sess->Preauh_Ha...